Downloads require an access key. Sign in with your access key to enable them.
Adfinis
Log in

Products / OpenBao / v2.6.4

OpenBao

OpenBao v2.6.4

Stable release v2.6.4 — binaries, Arch packages, an RPM repository, a DEB repository, and container images. Verification data: checksums, GPG signatures, Sigstore provenance, and SBOMs.

Release notes

SECURITY

  • core: Prevent disclosure of tls_acme_eab_mac_key from sys/config/state/sanitized. GHSA-3237-j65r-m5rp. [GH-4148]
  • core/audit: The unauthenticated "Root Token Generation" and "Rekey" endpoints (which are disabled by default) returned their response, even if audit logging failed. GHSA-q74w-hv5x-6hxf. [GH-4148]
  • auth/approle: Ensure Secret ID cannot be used for authentication after expiration but before tidy is called. GHSA-7m59-mp95-w6ph. [GH-4148]
  • auth/approle: Fix incorrect JSON-decode path when parsing login requests with form data bodies. GHSA-5v22-543h-wg96. [GH-4148]
  • auth/cert: Fix omission of TLS connection propagation when calculating role-based quota. GHSA-5v22-543h-wg96. [GH-4148]
  • auth/kubernetes: Ensure Service Account JWT is validated on renewal, preventing post-revoke usage. GHSA-gf3j-hm38-jhh5. [GH-4148]

What's Changed

  • Publish betas into testing RPM/DEB repos (#3385 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4074
  • Bump ubi10-minimal from e3a5632 to 204e153 (#4129 by @dependabot) backported by @satoqz in https://github.com/openbao/openbao/pull/4139
  • Bump github.com/hashicorp/cap from 0.13.0 to 0.14.0 (#4133 by @dependabot) backported by @satoqz in https://github.com/openbao/openbao/pull/4144
  • v2.7.1 - Security Fixes against release/v2.6.x (#4146 by @06kellyjac, @cipherboy, @phil9909, @satoqz, @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/4148
  • Add release notes for v2.6.4 by @satoqz in https://github.com/openbao/openbao/pull/4150

Full Changelog: https://github.com/openbao/openbao/compare/v2.6.3...v2.6.4

Binaries

Precompiled archives from the official GitHub release.

Packages

Install from mirrored RPM/DEB repositories (package signatures and signed repo metadata verified at sync), or download Arch packages from the release.

RPM

Add the mirrored RPM repository. YUM/DNF substitutes $basearch for the host architecture.

Credentials are stored in /etc/yum.repos.d/openbao.repo (mode 0600). Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Delete /etc/yum.repos.d/openbao.repo to remove the repository configuration.

read -rs ACCESS_KEY
sudo install -m 0600 /dev/null /etc/yum.repos.d/openbao.repo
sudo tee /etc/yum.repos.d/openbao.repo > /dev/null <<EOF
[openbao]
name=openbao
baseurl=https://releases.robertdebock.nl/pulp/content/openbao/rpm/\$basearch/
username=<CLIENT_NAME>
password=${ACCESS_KEY}
enabled=1
# Package signatures: verified with the upstream key (gpgcheck).
# Repository metadata: signed by the Adfinis mirror (repo_gpgcheck).
# List both keys under gpgkey so DNF can import them for packages and metadata.
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://openbao.org/assets/openbao-gpg-pub-20240618.asc https://releases.adfinis.com/keys/adfinis-repo-metadata.asc
EOF
unset ACCESS_KEY
sudo dnf install openbao

Browse RPM repositoriesSign in to download

Containers

Authenticate before pulling. Paste your access key at the hidden prompt when running the commands below.

Docker stores credentials in ~/.docker/config.json after login. Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Run docker logout releases.robertdebock.nl to remove registry credentials from ~/.docker/config.json.

read -rs ACCESS_KEY
echo "$ACCESS_KEY" | docker login releases.robertdebock.nl -u <CLIENT_NAME> --password-stdin
unset ACCESS_KEY
docker pull releases.robertdebock.nl/openbao/openbao:2.6.4

Verification

SHA256 checksums
66 files verified, 169 not covered by upstream checksums.
Checksum manifest authenticity
Signature verified against the pinned upstream key.
GPG signatures
Detached signatures mirrored alongside the artifacts.
Sigstore provenance
Sigstore bundles mirrored alongside the artifacts.
SBOM
SPDX documents mirrored for this release.

Checksum coverage is required for: arch_pkg, binary. A release with an unverified file in one of those classes is not published.

Checksums
GPG signatures
Cosign / Sigstore
SBOM

Release source

Upstream source
https://github.com/openbao/openbao/releases/tag/v2.6.4
Published upstream
2026-10-01
Last successful sync
— when this mirror last downloaded and verified the bundle

Browse release tree

All files for v2.6.4Sign in to download All versions